4e98ac2fe8eb8c08e207e2933c5151576bd60fb589fb1ccadec3a1bfc332d492

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_c58f444468906c321acaa4fddbfaaa4d_amadey_elex_glassworm_smoke-loader.exe
Size 4.6MB
Sample260701-ddwt8sez2t
SHA256 4e98ac2fe8eb8c08e207e2933c5151576bd60fb589fb1ccadec3a1bfc332d492
MD5 c58f444468906c321acaa4fddbfaaa4d
SHA1 e2241481e0a1fae90dae275bf4e7afcafe36e469
SHA512 0f00d5a2b108adab3ce94c3e8e0e636ac4f4903c05cecb63e1bc70182d5d81616d91dece5cf4e2a7678af10e1c2ef076d526729f30b4932b7762fef74862fddb
SSDEEP 98304:eoa1taC0ymyLFaL93JIonLrHp/qKm2/Sb/gqA:eoa3vmYoZzrRb/G
TLSH
T160368B53EB814AD9F7890436EF048150D72AF92997FB1221745C22CDEF93387BF61A29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4428	237C.tmp

Executes dropped EXE 1 IoCs

pid	Process
4428	237C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_c58f444468906c321acaa4fddbfaaa4d_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	237C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 4428	3440	2026-06-30_c58f444468906c321acaa4fddbfaaa4d_amadey_elex_glassworm_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-06-30_c58f444468906c321acaa4fddbfaaa4d_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_c58f444468906c321acaa4fddbfaaa4d_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Users\Admin\AppData\Local\Temp\237C.tmp
  "C:\Users\Admin\AppData\Local\Temp\237C.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-06-30_c58f444468906c321acaa4fddbfaaa4d_amadey_elex_glassworm_smoke-loader.exe E76FA5C31EE039950B3B254B3B9267FA2B3E2E5F09CF2357705C9E8C3F6ABFF854EC0B95B48995759C3569C9F9A27B3095672E0B7714D893F571762B1E9B8849
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

237C.tmp

Path C:\Users\Admin\AppData\Local\Temp\237C.tmp
Size 4.6MB
SHA256 2f600f8c598573bfe3da2ceaec583a7e41f05f18aecd76d8a3ca487acb7e8202
MD5 d8add55f2a273b58046b16fe24151eb3
SHA1 367b67d78de74e9fd6399a1af1b8c5e993973577
SHA512 136616aa6b7c968ee25ca01358398733c7e967e3b622bbfa5579173aa523f52c04370be3548c0abd367a25d3d39adfd96f3c160ffa2b2932b3187b19a1d817b4
SSDEEP 98304:eoa1taC0kjb/ytd+OTtSQ5XyxnLrHp/qKm2/Sb/gqA:eoa3f/ytdxD5XQrRb/G
TLSH
T1CD368B53EB814AD9F3890432DF448150D72AF92997FB1221346C62CDEF97387BF61A29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download