Analysis
- max time kernel
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
05/06/2026, 10:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe
Resource
win11-20260513-en
5 signatures
150 seconds
General
- Target 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe
- Size 1.2MB
- Sample260605-mg5e8aey3m
- SHA256 fcc0c19ac102d843316df07d1ef4f766e8c64fd6e91e3690a5a55236ba557a1f
- MD5 d414f9c212dcca35eee9fb5313fd1e98
- SHA1 fee22d847be6f311619ef406e7be567125f1920b
- SHA512 880483a4c5e61c7e1deb0d6df4aed728e768c9e4ae4ee24eea3e5610424ce3aaf8507a9ec6bdd59d860071c944ce92aae32af43e2b4d04e0bce57038e327c8ad
- SSDEEP 24576:xbi/QhDC8mY93kyw8hC2A5CxLbRpWrzzZyP4UMdcAx:I/QMnl5YL7WzZyQRdb
- TLSH T1FE451AAEB3A2C162EAE180B1F9B56225C964BC6B63384EC39F947C1CC4752C0FD35657
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\BISkas.cmd.desktop.exe\Outlook Logging\OUTLOOK_16_0_12527_20482-20260513T2357340860.etl 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\BISkas.cmd.desktop.exe\wctEC7E.tmp 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\BISkas.cmd.desktop.exe\{678F60C6-EEE7-424B-A1F8-C9AEB5615998} - OProcSessId.dat 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\b84e480e-efb7-491d-a618-fcb18fa75225.tmp 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\cv_debug.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\BISkas.cmd.desktop.exe\DefaultAppsNew.xml 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\BISkas.cmd.desktop.exe\wct1B43.tmp 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\BISkas.cmd.desktop.exe\wctF6E3.tmp 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\dd_vcredistMSI438A.txt 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\jawshtml.html 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\jusched.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260513235107_003_windowsdesktop_runtime_8.0.15_win_x64.msi.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\wctF6E3.tmp 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\BISkas.cmd.desktop.exe\AdobeSFX.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\BISkas.cmd.desktop.exe\b84e480e-efb7-491d-a618-fcb18fa75225.tmp 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\BISkas.cmd.desktop.exe\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\BISkas.cmd.desktop.exe\dd_vcredistMSI438A.txt 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\BISkas.cmd.desktop.exe\msedge_installer.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\DefaultAppsNew.xml 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\BISkas.cmd.desktop.exe\dd_vcredistUI438A.txt 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\a343ca33-270d-4d46-a7e5-992f993517ab.tmp 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260513235018.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260513235018_000_dotnet_runtime_6.0.27_win_x64.msi.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\BISkas.cmd.desktop.exe\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260513235018_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260513235018_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260513235107_002_dotnet_host_8.0.15_win_x64.msi.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\BISkas.cmd.desktop.exe\dd_vcredistMSI43A5.txt 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\AdobeSFX.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\mapping.csv 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\wctEC7E.tmp 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\~DFD70E69DDEA6E7FF0.TMP 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\BISkas.cmd.desktop.exe\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260513235107_003_windowsdesktop_runtime_8.0.15_win_x64.msi.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\BISkas.cmd.desktop.exe\wctD4C4.tmp 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\BISkas.cmd.desktop.exe\wmsetup.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260513235107.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\BISkas.cmd.desktop.exe\Microsoft .NET Framework 4.7.2 Setup_20260513_234955828.html 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\BISkas.cmd.desktop.exe\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260513235018_000_dotnet_runtime_6.0.27_win_x64.msi.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\BISkas.cmd.desktop.exe\EXUANKQH-20260513-2354a.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\BISkas.cmd.desktop.exe\jawshtml.html 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\BISkas.cmd.desktop.exe\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260513235042_002_dotnet_host_7.0.16_win_x64.msi.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\OneNote\16.0\Exported 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260513235018_002_dotnet_host_6.0.27_win_x64.msi.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\{418C1464-EC1A-4C82-A7C2-21C64E5E2B74} - OProcSessId.dat 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\2808149140\zmstage.exe 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\BISkas.cmd.desktop.exe\BroadcastMsg_1778716438.txt 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\OneNote\16.0 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\EXUANKQH-20260513-2354.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\JavaDeployReg.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260513235042_001_dotnet_hostfxr_7.0.16_win_x64.msi.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260513235042_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\{678F60C6-EEE7-424B-A1F8-C9AEB5615998} - OProcSessId.dat 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\BISkas.cmd.desktop.exe\2808149140\zmstage.exe 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\BISkas.cmd.desktop.exe\EXUANKQH-20260513-2354.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\BISkas.cmd.desktop.exe\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260513235107.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\BISkas.cmd.desktop.exe\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260513235107_002_dotnet_host_8.0.15_win_x64.msi.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\aria-debug-2640.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\EXUANKQH-20260513-2354a.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\f8420af3-e90d-4801-9aff-6f46fa834ff2.tmp 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\wctC47A.tmp 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\BISkas.cmd.desktop.exe\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260513235018_002_dotnet_host_6.0.27_win_x64.msi.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\BISkas.cmd.desktop.exe\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260513235107_000_dotnet_runtime_8.0.15_win_x64.msi.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\wctD4C4.tmp 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\BISkas.cmd.desktop.exe\wmsetup.log 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4428 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe 4428 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4428 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe 4428 2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-05_d414f9c212dcca35eee9fb5313fd1e98_amadey_elex_glassworm_smoke-loader.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4428
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\BISkas.cmd.desktop.exe\wct1B43.tmp
- Size 63KB
- SHA256 543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7
- MD5 e516a60bc980095e8d156b1a99ab5eee
- SHA1 238e243ffc12d4e012fd020c9822703109b987f6
- SHA512 9b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58
- SSDEEP 384:poaSLGTSy3S0XuMU9mCzHS7vpvpJGV6Hu/i49Pji7iJI5TZCP56vS1xDR+dBUFvT:WryF7U9mCzHS7vu/xV2iP56vcDR+P0T
- TLSH T18A53DD9E2108B66FE215AD5A7EABA9861C31746E3842CFCDF1CDC26C5F40DC4334A5A7
- MD5 SHA1 SHA512 SSDEEP TLSH