2267aad01795999693dd68ad3c52894490e690a851c35d48495f66ca107d1aa6

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_71775b23e2bae198740eb24c34dda7a6_amadey_elex_glassworm_smoke-loader.exe
Size 4.9MB
Sample260707-dklb3sdx5j
SHA256 2267aad01795999693dd68ad3c52894490e690a851c35d48495f66ca107d1aa6
MD5 71775b23e2bae198740eb24c34dda7a6
SHA1 89fd2721f86bc31d454e4bd4460c11438e5e8d7d
SHA512 cd0cedfff2206ef38fd7912bdc3f7bbf282c3040bbccc81164865c97710e90dc7152623fdf6acd44f0550d02db7ae33febc78cc527e51dc76cc308a953386260
SSDEEP 98304:gmSWOiIyUSxS2DqMV6bRs6B8L0VLUjH5oxFbx3nLrHp:gXF2Dl2Rs6B8AVUjZEdbr
TLSH
T14036BD53EB814AD9E38D0476EF548150972AF62997FF1261385802CCEE87387BF61A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3768	40B8.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_71775b23e2bae198740eb24c34dda7a6_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	40B8.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 3768	5040	2026-07-06_71775b23e2bae198740eb24c34dda7a6_amadey_elex_glassworm_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-06_71775b23e2bae198740eb24c34dda7a6_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_71775b23e2bae198740eb24c34dda7a6_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Users\Admin\AppData\Local\Temp\40B8.tmp
  "C:\Users\Admin\AppData\Local\Temp\40B8.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-06_71775b23e2bae198740eb24c34dda7a6_amadey_elex_glassworm_smoke-loader.exe E97010270986CC2B67F333322F5846CC2731DF60717AB9EA719E5393C37E229C2EFE0EB46DD1BF4E363DC9DDAAC40500D16B3C985693067E2BE87371552EE1F4
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

40B8.tmp

Path C:\Users\Admin\AppData\Local\Temp\40B8.tmp
Size 4.9MB
SHA256 493c347778133fce4f2e3c0ec05cb2e73b71e8a9857ff23765bf1fa39525bfa2
MD5 07e08f686453435b0b754466ab02ccf6
SHA1 698003c2189fb86b1e78b05feacdc9f9e091a9c6
SHA512 d3acfbe813f216f99f03bbeaa5ec01b862f9505ec793b900c409e2749464b8edd8fc7846ba58a7305df886eeb91aa7d9327251ae591edce34f5d69db5e06498f
SSDEEP 98304:gmSWOiIyUWJrsphyeug0PFy2eZVLUjH5oxFbx3nLrHp:gXs4pYUQ6ZVUjZEdbr
TLSH
T1AC36AD53EB814AD9E38D0476EF548150972AF22997FF1261395802CCEE87387BF61A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download