439c5b5196f10053e6a638f98bd5426046ad437a703fc760208e0ec3e891ce1c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_4bd1c3f852123931f86245bf901308cd_amadey_elex_glassworm_icedid_njrat_smoke-loader.exe
Size 2.8MB
Sample260707-ejapmaht6x
SHA256 439c5b5196f10053e6a638f98bd5426046ad437a703fc760208e0ec3e891ce1c
MD5 4bd1c3f852123931f86245bf901308cd
SHA1 c48ff1ea1fb10310f98b92593847612f52ac49f0
SHA512 75b8f5ac3e5ee544e4a4fa34215998ccc71f6648fc5f725633e26e991cb66062065749a9c191cd68b17b4adb57976198d2564cbb2762b7d487935e7b9b0fa742
SSDEEP 49152:Toa1taC070UCQOrh0TERqM08jlxjRQ1GZKxWv/u9/H1l:Toa1taC0ory/M9jlxC1GVs/H
TLSH
T122D59B57E7808AD9D7990936DF108150932AF52D9BFB1632788812CDEE53787BF21A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5172	2DB2.tmp

Executes dropped EXE 1 IoCs

pid	Process
5172	2DB2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_4bd1c3f852123931f86245bf901308cd_amadey_elex_glassworm_icedid_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2DB2.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 5172	4732	2026-07-06_4bd1c3f852123931f86245bf901308cd_amadey_elex_glassworm_icedid_njrat_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-06_4bd1c3f852123931f86245bf901308cd_amadey_elex_glassworm_icedid_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_4bd1c3f852123931f86245bf901308cd_amadey_elex_glassworm_icedid_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Users\Admin\AppData\Local\Temp\2DB2.tmp
  "C:\Users\Admin\AppData\Local\Temp\2DB2.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-06_4bd1c3f852123931f86245bf901308cd_amadey_elex_glassworm_icedid_njrat_smoke-loader.exe D0C16B6113B81011856DDAA412CB30257D9AA9EF2B18AAD3A0AC0192E38B83E78423BEFDD649AE43CAD2F1AF3D35C0E1AEE20F28824B60FB6973B1DD04C02134
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2DB2.tmp

Path C:\Users\Admin\AppData\Local\Temp\2DB2.tmp
Size 2.8MB
SHA256 2f721483baa6bfac3dc1c7d794f1d8315a37393da9859e7f5a3fcc1440d5af8a
MD5 db71954cdb65b5cb75913ee6f3e2fc51
SHA1 ce750171bd58bd2ce925ec6e76c9a3f07d71fe9e
SHA512 203f62fff19e72c424249c4bf4bb417f66223d9d75907199b0649bd139639bac153f41f7ae2b9ab315dd51977803cebcd8d5f3dd3be3386abc594132394102e8
SSDEEP 49152:Toa1taC070URTbRPSe8kUDlZnyyOJ2ZTsn:Toa1taC0fRPB8kMZnyy+9
TLSH
T13BD59B57E7818AD9D7990876DF108190932AF12D5BFB5632788812CCEE53787BF21A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download