Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
05/06/2026, 22:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe
- Size 3.4MB
- Sample260605-2bb9taev6w
- SHA256 8e10b51126a6897945988ad41b694e682cc866f14a82c05f5c9722b149cd0307
- MD5 6a4e0a8a430625394da4700a5681f704
- SHA1 1f4c9957c4ea198d14624f02ed8791e902d663ef
- SHA512 1a72fc1de7bebc0981d357fa0387c38754e1b074e923dde5601754e9e7abfe8a06be99260fa5817ad2b2cff4f4a664341eb4542b341cbdc4c8863ddba2d148a7
- SSDEEP 24576:6MK/PobNMuezTxNGDd6nCtpzxTuh8WpkPpz6ylzGlvGkw7:bKyEzTxMtpzpDBGyo
- TLSH T1E4F57403AA5851AFE992973BD4871F71E37C64C65A30A9D378B0F1F89E229C05835FD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Drops desktop.ini file(s) 4 IoCs
description ioc Process File created \??\c:\$Recycle.Bin\S-1-5-21-226940941-599731907-2645636698-1000\desktop.ini 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\$Recycle.Bin\S-1-5-21-226940941-599731907-2645636698-1000\desktop.ini 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File created \??\c:\Program Files\desktop.ini 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\desktop.ini 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\System.Windows.Forms.Design.resources.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Presentation.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-process-l1-1-0.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\ca-ES\tipresx.dll.mui 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ReachFramework.resources.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\System.Windows.Input.Manipulations.resources.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\bg_NEUTER.pak 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ko_FEMININE.pak 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Claims.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationUI.resources.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-math-l1-1-0.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Primitives.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Thread.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Emit.ILGeneration.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ta_FEMININE.pak 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l2-1-0.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\th.txt 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.VisualC.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationCore.resources.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\UIAutomationTypes.resources.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Sockets.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Xaml.resources.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClient.resources.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\bn_MASCULINE.pak 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\java.exe 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\Microsoft.VisualBasic.Forms.resources.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\System.Windows.Forms.resources.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\System.Windows.Forms.Design.resources.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\zh-TW_FEMININE.pak 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\Internet Explorer\iediagcmd.exe 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\ca-ES\tipresx.dll.mui 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Collections.Immutable.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.resources.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationProvider.resources.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Forms.Design.Editors.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\PresentationCore.resources.dll 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe File opened for modification \??\c:\Program Files\Common Files\System\ado\msado20.tlb 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1884 5220 WerFault.exe 79 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-05_6a4e0a8a430625394da4700a5681f704_amadey_elex_glassworm_smoke-loader_vidar.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5220 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 5842⤵
- Program crash
PID:1884
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5220 -ip 52201⤵PID:4448
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.dll
- Size 5.2MB
- SHA256 b1b225713d4ced4837fb77052cfe68bb93fab7b24c0b2af0625a4beba0c4a9dc
- MD5 c99c1ac36752687cdf071eddef6f511b
- SHA1 f963cb6c11f55d5f3c9c04ac265009fb9b981e77
- SHA512 43f3899daf5b263dfa34152c8278c9ad5931f167b877405ddf9ad7f1d61146280e4c2c92dfe21bf4c07cfbc7f2473f19008bd91201320d5978b9b1d2b68ea23b
- SSDEEP 24576:6MK/PobNMuezTxNGDd6nCtpzxTuh8WpkPpz6ylzGlvGkw7eezTxNGDd6nCtpzxTn:bKyEzTxMtpzpDBGyoQzTxMtpzpDBGyo
- TLSH T14946D703FA6841AFE892D33AC4875BB1E77874C65730A9D365A0F1F8AE239D05435F98
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\am_MASCULINE.pak
- Size 23B
- SHA256 b189beaa211d90f2d81ce45beb5790fe72e9fff13dca5f46ad1461489fe59106
- MD5 b3f6ee17e4d70043651e0205fd942631
- SHA1 09659cf4c7613e3196125ecc6b491ea345993980
- SHA512 bda3d9506c22cdb0f06bc4ff08b7948530dd23dc4f39e544c604bd892ff9b73665f0bf2e7c7228e3d0fc4d72c8a285e40b71443ef57beac0df993a572626dc76
- MD5 SHA1 SHA512
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore_amd64_amd64_6.0.2724.6912.dll
- Size 5B
- SHA256 30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76
- MD5 b5b682b742431a52ea8b17c72ad9c572
- SHA1 326320f469235708c59f678c9a7357dca552d306
- SHA512 4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163
- MD5 SHA1 SHA512