267f7e193a503bb2c938ec0d369dd47bb78b5cff7ac9a4c03049e71e3a68ab62

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 14:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_c7914c8c12d9d02d52fcdec8dea48a0c_amadey_elex_glassworm_smoke-loader.exe
Size 3.7MB
Sample260704-r166dagv41
SHA256 267f7e193a503bb2c938ec0d369dd47bb78b5cff7ac9a4c03049e71e3a68ab62
MD5 c7914c8c12d9d02d52fcdec8dea48a0c
SHA1 e5b2eea3c834e00b9c65c567c0fe3b7fcfa6af04
SHA512 c75ef90b6ccd0491b90a19efac976d036598eda2b6b952af5a07117a40aa5c5120c9f7095f262b00073033282b73db62de6035ef295e211f3c8da151f22aa266
SSDEEP 49152:1oa1taC070UViINsuqNykZ9dZDgOA6QZjdsgBoYRlVmgbQIzZMPXpB91rHp:1oa1taC0CI6u2ZDgOAlldsgBmnLrHp
TLSH
T1B506CF53EB918AE8E24D09766F584150D62EF621AB8F2351786C120DCF8738B9F61F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2076	6F9D.tmp

Executes dropped EXE 1 IoCs

pid	Process
2076	6F9D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_c7914c8c12d9d02d52fcdec8dea48a0c_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6F9D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 2076	716	2026-07-04_c7914c8c12d9d02d52fcdec8dea48a0c_amadey_elex_glassworm_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-04_c7914c8c12d9d02d52fcdec8dea48a0c_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_c7914c8c12d9d02d52fcdec8dea48a0c_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:716
- C:\Users\Admin\AppData\Local\Temp\6F9D.tmp
  "C:\Users\Admin\AppData\Local\Temp\6F9D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-04_c7914c8c12d9d02d52fcdec8dea48a0c_amadey_elex_glassworm_smoke-loader.exe AEBDB9D6B285CB470115E89F9DD4530FAAA2FFF211211D6E4DE3614FC7EE0B86381F9500066CE4311C32004EEE23CAC900F9783463FC196DC2CE7EE1D1C11371
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6F9D.tmp

Path C:\Users\Admin\AppData\Local\Temp\6F9D.tmp
Size 3.7MB
SHA256 b2250d124411f443971cf608a8b56d37f1ef5b96ed98e02cf8f9120a65bc902b
MD5 ec9044e0b35512469c086b6bcfa997d4
SHA1 5bb642970501ff658295301ee55108bba9b27ceb
SHA512 57945a0d5028a1e142d0c9038f42530604a52d75b893ebf9fd304f4aea26be9616f56ab83cbec6620a59d3976da8ce8d4604dab33a1ec352fc01345e9f1ece0f
SSDEEP 49152:1oa1taC070Uv5BCIDo9nOOR76RrzFLMMjTVmgbQIzZMPXpB91rHp:1oa1taC0V5EIDmOMORvdMKCnLrHp
TLSH
T15006CF53EB918AE8F28D09766B584150D62EF221AB8F1351796C130DCF87387AF61E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download