439c5b5196f10053e6a638f98bd5426046ad437a703fc760208e0ec3e891ce1c

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_4bd1c3f852123931f86245bf901308cd_amadey_elex_glassworm_icedid_njrat_smoke-loader.exe
Size 2.8MB
Sample260707-ejapmaht6x
SHA256 439c5b5196f10053e6a638f98bd5426046ad437a703fc760208e0ec3e891ce1c
MD5 4bd1c3f852123931f86245bf901308cd
SHA1 c48ff1ea1fb10310f98b92593847612f52ac49f0
SHA512 75b8f5ac3e5ee544e4a4fa34215998ccc71f6648fc5f725633e26e991cb66062065749a9c191cd68b17b4adb57976198d2564cbb2762b7d487935e7b9b0fa742
SSDEEP 49152:Toa1taC070UCQOrh0TERqM08jlxjRQ1GZKxWv/u9/H1l:Toa1taC0ory/M9jlxC1GVs/H
TLSH
T122D59B57E7808AD9D7990936DF108150932AF52D9BFB1632788812CDEE53787BF21A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4192	422F.tmp

Executes dropped EXE 1 IoCs

pid	Process
4192	422F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_4bd1c3f852123931f86245bf901308cd_amadey_elex_glassworm_icedid_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	422F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 4192	2308	2026-07-06_4bd1c3f852123931f86245bf901308cd_amadey_elex_glassworm_icedid_njrat_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-06_4bd1c3f852123931f86245bf901308cd_amadey_elex_glassworm_icedid_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_4bd1c3f852123931f86245bf901308cd_amadey_elex_glassworm_icedid_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Users\Admin\AppData\Local\Temp\422F.tmp
  "C:\Users\Admin\AppData\Local\Temp\422F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-06_4bd1c3f852123931f86245bf901308cd_amadey_elex_glassworm_icedid_njrat_smoke-loader.exe 648B55DE3307F3027805CCFF0F9B6B00B22DCF214612CC02C27C32CB427149CC6B77C493412FEC201C65F9F140B808EFDA06089127A0FC43C6E9832099CF0945
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

422F.tmp

Path C:\Users\Admin\AppData\Local\Temp\422F.tmp
Size 2.8MB
SHA256 9371cec298f34d10e1787ad5989273701ca0976c5c8fe30f71ab923d521dfd40
MD5 811f6bfaa9fd3b4d022d7261ba808502
SHA1 698c1a48a33576eea3a1dd5f248e8d5d00bf7ef8
SHA512 67fe1d727999a2425af960b5aea4cfccb1669431862d413bb1aa2fbe4e84cf3fe9f3d5d17191eead4eae40479b76b3c63a4fac0dbc6c94cc9632ff4d68a2afb8
SSDEEP 49152:Toa1taC070UqACBVLF6Hg97pTRVn02C7B:Toa1taC0oXvyg9F9N
TLSH
T149D58B57E7808AD9D7990932DF108190932AF52D5BFB5632389C12CDEE53787BF21A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download